Privacy Aspects of Forensic Computing

Privacy Aspects of Forensic Computing

Privacy is usually perceived as a limiting factor in forensic investigations, particularly with regard to digital traces. In many cases the investigation of such traces yields large amounts of data which could be analyzed automatically. The aim of this project is to examine one part of this area of conflict – the field of forensic data aquisition as part of a seizure.

The state-of-the-art method for aquiring data – especially from private individuals – is to create a physical copy of the storage medium (forensic 1:1 copy or image). This type of copy necessarily includes all private data irrespective of its relevance to the investigation. In consequence forensic investigations often intrude on the owners privacy which necessitates that the applied methods satisfy the principle of proportionality. To what extent and in which cases forensic investigations intrude on privacy is still an open question. This question will be studied in this project.

Points of interest are:

business environment vs. private environment

normal user vs. adept user

police officer vs. private investigator

investigation with or without judicial decision

content types of private data

investigations in social networks

Email analysis

cloud computing

live/network/dead analysis

Currently we conduct empirical studies based on questionnaires and interviews of forensic investigators in order to obtain details on the forensic methods applied in various cases. The final aim of our work is to identify legal problems in forensic practice as well as legal prerequisites and limitations for forensic investigations.

This project is being realized in cooperation with Seicpro – Marion Liegl.